Incorporating Cyber Resilience into Computable General Equilibrium Models

Most countries are becoming increasingly dependent on cyber inputs for business, government, and private pursuits. Disruptions of the cyber system can therefore have extensive economic consequences. Resilience is a major way to reduce consequences such as business interruption after the disaster strikes by promoting business continuity and recovery. One approach to analyzing and measuring its effectiveness is to incorporate resilience into economic consequence analysis models of various types, such as Computable General Equilibrium (CGE) models. These models have several attractive properties that make them especially valuable, including being based on behavioral responses of individual producers and consumers, having a role for prices and markets, having the ` to trace economic interdependence, and being based on a non-linear structure that can reflect flexibility of various components. Cyber resilience is a case of economic resilience, pertaining to preventing: (1) supply-side reduction of cyber product and service disruptions to direct and indirect down-stream customers, which also reduces disruptions to the cyber sectors’ own direct and indirect up-stream suppliers; and (2) demand-side reduction by customers of their losses from cyber disruptions, which also reduces further upstream and downstream losses. We summarize established and new methodological advances in explicitly incorporating cyber resilience into CGE models. Several types of resilience are inherent, or already naturally included, in CGE models in relation to their core focus (e.g., substitution of inputs in relation to the input scarcity and the allocative mechanism of price signals). Other types of resilience are adaptive in terms of ad hoc reactions after the disaster strikes (e.g., business relocation and lining up new suppliers from within or outside the affected area). Our framework for incorporating various cyber resilience tactics into CGE models is based on economic production theory in relation to decisions regarding inputs and outputs. We explain the methodological refinements needed and provide real world examples of cyber resilience tactics.